Agent Ensure Workspace

Plan #1: lazy workspace provisioning.

Called by the agent’s can_use_tool_callback the first time a write-tool fires in a turn (Edit, Write, MultiEdit, Bash, Read on a /data/user-addons/ path). Triggers branch resolution + pod-side git clone, marks the task as provisioned, returns the resolved branch info.

Idempotent: subsequent calls for the same task return the cached result (warm=True) without re-resolving or re-cloning. The per-task asyncio.Lock serializes concurrent calls from one agent.

Auth: shared pod token, same pattern as /api/agent/pr/create.